At All Street - we use Auth0 for authenticating users and lookup user purchases in Stripe for authorisation. This is probably overkill for most usecases. Some of our internal tools use Basic Auth which can work fine for internal users and demos.

I guess it depends on your requirements. I’d externalize authentication to something like Okta, Auth0, Keycloak, etc. Authorization, Open Policy Agent. Although I might be biased 🙂

Authorisation could be as simple as fields in your user database or a config file or permissions - doesn't have to be an external managed service.

Yep, depends largely on whether it’s a distributed application on being built, or a monolith.

Problem with external managed auth service is price. Ours started as free and has risen to $400 per month - for effectively the same thing. For that amount it would have been better to go for internal auth from the start.

There are many open source providers for external authentication though.

Yup - we'll consider options at some point. When we started using it we weren't expecting it to shoot up as much.

There is a nice Clojure wrapper for Keycloak that you may wanna check out. https://nextjournal.com/schmudde/keycloak-environment

https://github.com/jgrodziski/keycloak-clojure

And there is Friend - older and Buddy - most used for new stuff https://github.com/coast-framework/coast/blob/master/docs/authentication.md

Author of https://github.com/jgrodziski/keycloak-clojure here feel free to ask anything! I find Keycloak efficient and battle-tested at runtime, authentication is very easy as it follows OAuth2/OIDC and it’s just some redirect mechanisms and token verification. Keycloak deals with all the authentication workflow very easily. The https://www.keycloak.org/docs/latest/authorization_services/index.html is exhaustive but imho worth the effort only for extensive needs. Role-based access control is easy to setup in Keycloak (as the source of truth of roles granted to identity) and for enforcement in application it depends of the lib you use but it’s easy to setup with Yada or with a ring-middleware (look at keycloak-clojure doc for details on that or msg me). For authorization the topic is wide but some newcomers in that field seems interesting : https://www.aserto.com , https://github.com/Permify/permify, https://www.openpolicyagent.org/ but don’t have first hand experience…

https://github.com/anderseknert/clj-opa

(I work on the OPA project 🙂)

Thanks everyone! I will check all of these.